183 reputation
17
bio website designingefficientsoftware.wo…
location Las Vegas, NV
age 56
visits member for 2 years, 4 months
seen Feb 26 at 19:40

Software developer for over 25 years. Interested in efficient software methodology, user requirements, design, implementation, and testing. Experienced with C#, VC , VB, Sql Server, and office tools. MCSD.


May
15
awarded  Notable Question
Jan
12
awarded  Popular Question
Oct
3
awarded  Popular Question
Dec
1
accepted Why is the IV passed in the clear when it can be easily encrypted?
Apr
9
comment What is the difference between CBC and GCM mode?
Very interesting... If I understand correctly, you are saying that in GCM mode the ciphertext of a block is exlusive-or'ed against the plaintext that was just put through the cipher and that block is then sent. If this is true, then how is that block decrypted? Isn't the ciphertext from the AES (for example) encryption required to decrypt the data? How is that obtained? Also, if the original encrypted text is obtained, then it could be used to exclusive-or the sent ciphertext which would return the plaintext and would not need further decryption... I'm missing something...
Apr
9
awarded  Supporter
Apr
9
accepted What is the difference between CBC and GCM mode?
Apr
8
asked What is the difference between CBC and GCM mode?
Apr
5
comment Why is the IV passed in the clear when it can be easily encrypted?
You are right Henrick. The IV is sent in the clear since it is the encrypted bytes of the last block that is used as the next IV. I think that this is unwise and potentially vulnerable in the future even if no one can positively state today that there is a vulnerability with this approach. I have an idea for a new mode that would use an IV that would not need to be sent at all. Actually, it would be 2 new modes. One for streaming messages that are sent sequentially and another mode for messages that are intermittent in nature. I will post a link back when I have published them.
Apr
5
comment Why is the IV passed in the clear when it can be easily encrypted?
"Note that what you propose comes down to prepending the IV to the plain text, and then encrypt the plain text with a zero'ed out IV. That is, at least for CBC mode encryption " - Well, sort of. It simply won't do an xor at all for the first block which contains the IV. But as I said in the question, that should not be a problem since the IV will be completely random. If you see a problem with this, then can you please elaborate
Apr
5
comment Why is the IV passed in the clear when it can be easily encrypted?
"It's a common error to use the same key to encrypt both the IV and the message, but this should never be done because it allows an attacker to "undo" the randomness that's supposed to be created by the IV." Are you talking about counter mode here? I was not aware that encryption of the counter should be used with a different key than the plaintext. Do you have any links that provide more details about this? Right now, I don't understand how a message with a counter could be broken more easily by using the same key as the rest of the message.
Apr
5
comment Why is the IV passed in the clear when it can be easily encrypted?
It is true that encrypting the IV takes longer. I am planning on writing an article that I'm hoping to publish either in a magazine or on my blog that benchmarks how fast symmetric encryption is with Microsoft classes in the .NET framework as well as some techniques that can be employed to dramatically improve perforance by at least 2.5 times, which is from results that I have already observed. Based upon my results, block encryption of 16 bytes with a 128 bit key can be done on my i7-950 machine roughly 2.5 million times per second using single threaded C# code.
Apr
5
comment Why is the IV passed in the clear when it can be easily encrypted?
Ok... Good point. The previous crypted data block that was sent is used as the next IV for decrypting. I guess in answer to your question, it is a matter of philosophy. If I have a choice between giving a potential attacker something to chew on, like a plaintext IV, or nothing at all like an encrypted IV, then I prefer to give him nothing at all. I would also point out that it is tough to predict the future. No one really knows what advances there will be in breaking encryption schemes in the future. A plaintext IV may be just enough to help an attacker to break in some day...
Apr
4
asked Why is the IV passed in the clear when it can be easily encrypted?
Mar
30
awarded  Student
Mar
15
awarded  Editor
Mar
15
revised Does a public key absolutely need to be used to initiate an encrypted session?
edited body
Mar
15
answered Does a public key absolutely need to be used to initiate an encrypted session?
Mar
15
awarded  Scholar
Mar
15
comment Does a public key absolutely need to be used to initiate an encrypted session?
Thank you for explaining why Cast should not be used today. Because of this, I am choosing your answer as the best answer.